ExtraHop Reveal(x)

Reveal(x) is ExtraHop's network detection and response platform for finding threats and investigating network activity across hybrid environments. ExtraHop positions it alongside network performance monitoring, intrusion detection, and packet forensics rather than as a simple antivirus tool. [ExtraHop Reveal(x)](https://www.extrahop.com/platform/revealx)

Its sensors receive mirrored or tapped traffic through SPAN ports, physical or virtual taps, and aggregation switches. They are passive and out of line, so the platform observes traffic without sitting as a firewall in the traffic path. [ExtraHop How It Works](https://www.extrahop.com/platform/revealx/how-it-works)

Reveal(x) uses protocol decryption and decoding to turn packet data into application and transaction records, and ExtraHop supports physical and virtual sensors for on-premises and cloud networks. The exact visibility depends on sensor placement and what traffic can be decrypted. [ExtraHop How It Works](https://www.extrahop.com/platform/revealx/how-it-works)

Reveal(x) focuses on network evidence and lateral movement, while EDR focuses on endpoint activity and a SIEM usually centralizes logs and alerts. ExtraHop describes Reveal(x) as combining NDR, NPM, IDS, and network forensics, so it is generally used alongside endpoint and log tools. [ExtraHop Reveal(x)](https://www.extrahop.com/platform/revealx)